fix(crowdsec): fetch the bouncer on the controller, not on the host

The deploy failed on proxy-1: Request failed: <urlopen error [Errno 101] Network is unreachable> url: https://github.com/.../crowdsec-firewall-bouncer-linux-amd64.tgz proxy-1 is IPv6-only, and neither github.com nor objects.githubusercontent.com publishes an AAAA record. The host cannot reach GitHub at all, so no retry or timeout would have helped. Two alternatives do not work either. Mirroring into gitea.renner.uno is out: its public records are the internal LB VIP (10.2.99.86 / fd99::86), so it is unreachable from outside the LAN. And there is no upstream container image for this bouncer, which is expected of something that manipulates host netfilter — crowdsecurity publishes cloudflare, fastly, custom and others, but no firewall bouncer. So the controller fetches and pushes instead of the host pulling. The CI runner has v4. The checksum is still verified, now before anything reaches a host, which is the better place for it anyway. The repo had told me twice that proxy-1 is the v6-only member — in unifi_nat_hairpin.tf and in the netbird-proxy role's dhcpcd comment — and I wrote it into the PR description myself. I never asked whether a v6-only host can reach GitHub. Nothing was deployed before this: the play runs serial: 1, proxy-1 went first and failed, so proxy-2 never started. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-02 13:25:39 +02:00
1 changed files with 25 additions and 8 deletions
@@ -19,32 +19,49 @@
    state: directory
    mode: "0755"

- name: Fetch the pinned bouncer release
+# Fetched on the CONTROLLER and pushed, not pulled by the host.
+#
+# proxy-1 is IPv6-only, and neither github.com nor objects.githubusercontent.com
+# publishes an AAAA record — a get_url on the host fails with "Network is
+# unreachable" and no amount of retrying fixes it. Mirroring into
+# gitea.renner.uno is no help either: its public records are the internal LB
+# VIP (10.2.99.86 / fd99::86), so it is unreachable from outside the LAN. And
+# upstream ships no container image for this bouncer, which is expected —
+# it manipulates host netfilter.
+#
+# The CI runner has v4, so it does the fetching. The checksum is verified
+# there, before anything is copied to a host.
+- name: Fetch the pinned bouncer release on the controller
  ansible.builtin.get_url:
    url: >-
      https://github.com/crowdsecurity/cs-firewall-bouncer/releases/download/{{
      crowdsec_bouncer_version }}/crowdsec-firewall-bouncer-linux-amd64.tgz
-    dest: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
+    dest: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
    checksum: sha256:{{ crowdsec_bouncer_sha256 }}
    mode: "0644"
+  delegate_to: localhost
+  become: false
+  run_once: true

 # Only the binary. The tarball also carries install.sh / upgrade.sh /
 # uninstall.sh, which manage systemd and config themselves — that is this
 # role's job, and letting them run would leave two owners for the same files.
- name: Unpack the bouncer binary
+- name: Unpack the bouncer binary on the controller
  ansible.builtin.unarchive:
-    src: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
-    dest: /opt
+    src: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
+    dest: /tmp
    remote_src: true
    include:
      - crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
-    creates: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
+    creates: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
+  delegate_to: localhost
+  become: false
+  run_once: true

 - name: Install the bouncer binary
  ansible.builtin.copy:
-    src: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
+    src: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
    dest: /usr/local/bin/crowdsec-firewall-bouncer
-    remote_src: true
    mode: "0755"
  notify: Restart crowdsec firewall bouncer